beelzebub

What it is

Beelzebub is an open-source deception runtime framework implemented in Go. It deploys adaptive decoy services across multiple protocols (SSH, HTTP, TCP, TELNET, MCP), leveraging LLMs to generate contextually relevant responses for attackers, and supports a plugin system for extending behavior. It emphasizes collecting threat intelligence and detecting prompt injection attacks against AI agents.

How it works

Beelzebub provides a two-tier configuration model:

• Core configuration (beelzebub.yaml) for global settings like logging and tracing
• Service configurations (services/*.yaml) for per-decoy definitions Plugins can register via an init() and be compiled into the binary. Deception services include MCP, HTTP, SSH, TELNET, and TCP, with support for static handlers or plugin-driven dynamic responses. Observability includes Prometheus metrics and RabbitMQ for event streaming.

Getting started

Key commands from the README:

• Installer:

./install.sh     # asks local or Docker, checks prerequisites, and starts it

• Local (Go):

make start     # installs any declared plugins, compiles them in, and runs

• Docker:

make docker    # builds an image with declared plugins baked in, then runs it

• Using Helm (Kubernetes):

helm install beelzebub ./beelzebub-chart
# Upgrade:
helm upgrade beelzebub ./beelzebub-chart

CLI basics:

• beelzebub run to start all configured deception services with options for core and services config paths and memory limit
• beelzebub validate to parse/validate configs without starting services
• beelzebub plugin to manage plugins (install/list/remove)
• beelzebub version for version and environment info

Recent releases

Latest versions include:

• v3.8.0 (2026-06-02): build(deps) bump and feature to preserve raw client bytes in
• v3.7.3 (2026-05-28): code of conduct link fix and dependency bump
• v3.7.2 (2026-05-18): dependency bumps and tracer improvements
• v3.7.1 (2026-04-30): add realClientAddr and CLI/code coverage improvements
• v3.7.0 (2026-04-28): new plugin system and dependency updates

Traction

Repository stars: 2128. Forks: 206. Open issues: 10.

Behind the repo

Beelzebub is hosted under the beelzebub-labs organization and describes itself as a deception runtime framework with LLM-enabled decoys across multiple protocols and a plugin architecture. It is licensed under GPL-3.0 and released in Go.

Caveats

License: GNU GPL v3 License. See LICENSE in repository. Release notes indicate updates to dependencies and features; specific caveats are not detailed in the excerpt. The latest push date is 2026-07-30.